Re: Re: for rbd, how to use qmp directly to add dick

On Tue, Nov 02, 2021 at 12:28:29 +0800, longguang.yue wrote: Firstly I'd like to ask you to follow mailing list posting netiquette and don't drop the mailing list on replies from the CC list. My reply would then not end up in the archives and the community would not be able to refer to it later. So this makes this out of scope for libvirt. A better forum to ask qemu-only related questions is the qemu mailing list. You can also make this a case for the Kata community to adopt usage of libvirt, as libvirt gives you a stable, secure and tested way to manage a qemu process. I think the Kata project would benefit from libvirt usage and could focus their efforts on adding features rather than reinventing what libvirt has for a long time already. Note that would be insecure as anybody with access to the host could read the commandline and know your secret. Let's rephrase your question to: "How does libvirt securely pass passwords to qemu on the commandline?" Libvirt uses two kinds of secrets, which both are secure when used properly: (Note that libvirt nowadays uses direct JSON with -object as it's possible starting with qemu-6.0, thus my examples will use the new format) 1) Secret stored in a file: -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/tmp/lib/domain--1-QEMUGuest1/master-key.aes"}' libvirt uses this format to pass the master key, which is used to encrypt other secrets, but any other secret can be passed this way. It's a bit tedious, and that's the reason why libvirt passes only the master key using the file. When the access permissions are set properly this way is secure. 2) Inline (base64) encrypted secrets -object '{"qom-type":"secret","id":"libvirt-5-storage-auth-secret0","data":"9eao5F8qtkGt+seB1HYivWIxbtwU6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1","keyid":"masterKey0","iv":"AAECAwQFBgcICQoLDA0ODw==","format":"base64"}' This secret is encrypted using the master key (as you can see above). When inspecting the commandline an attacker can't tell the original value. Theoretically when using the monitor (QMP) it's also secure to pass a plaintext secret, but that's tricky if the monitor traffic is logged, so libvirt opted to use encrypted secrets also in that case. For any other use please refer to the qemu documentation: https://gitlab.com/qemu-project/qemu/-/blob/master/qapi/crypto.json#L386 The above direct link describes how to use the secret object. (I'm deliberately not showing the insecure usage so that it's not getting copied around).